Skip to content

Commit c4c15e2

Browse files
author
Damien Dallimore
committed
hec appenders
1 parent 592879b commit c4c15e2

17 files changed

+193
-17
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ There are also custom handler/appender implementations and config examples for t
1111

1212
This framework contains :
1313

14-
* Implementation of Splunk CIM(Common Information Model) and best practice logging semantics
1514
* java.util.logging handler for logging to Splunk REST endpoints
1615
* java.util.logging handler for logging to Splunk Raw TCP Server Socket
1716
* java.util.logging handler for logging to Splunk HEC Endpoint
@@ -21,7 +20,9 @@ This framework contains :
2120
* Logback appender for logging to Splunk REST endpoints
2221
* Logback appender for logging to Splunk Raw TCP Server Socket
2322
* Logback appender for logging to Splunk HEC Endpoint
24-
* Example logging configuration files
23+
* Log4j 2 appender for logging to Splunk HEC Endpoint
24+
* Log4j 2 config examples for TCP and UDP logging
25+
* Example logging configuration files for all the above
2526
* Javadocs
2627

2728
If you want to use UDP to send events to Splunk , then Log4j 1.x and Logback already have Syslog Appenders.

‎build/build.xml

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,52 @@
126126
<delete dir="${temp_build}" />
127127

128128
</target>
129+
130+
<target name="build_log4j2" depends="compile"
131+
description="generate a log4j2 only distribution">
132+
<!-- Create the distribution directory -->
133+
134+
135+
<copy todir="${temp_build}/${lib}">
136+
<fileset dir="${lib}"
137+
includes="splunk_tlsv12.jar,log4j-api-2.3.jar,log4j-core-2.3.jar,commons*.jar,http*.jar" />
138+
139+
</copy>
140+
141+
142+
143+
<copy todir="${temp_build}/${config}">
144+
<fileset dir="${config}" includes="log4j2.xml" />
145+
</copy>
146+
147+
148+
<copy todir="${temp_build}/3rdparty_licenses">
149+
<fileset dir="3rdparty_licenses" />
150+
</copy>
151+
152+
153+
<copy todir="${temp_build}">
154+
<fileset file="LICENSE" />
155+
<fileset file="README.md" />
156+
</copy>
157+
158+
159+
<jar jarfile="${temp_build}/${lib}/${id}-log4j2.jar">
160+
<fileset dir="${temp_build}/${classes}"
161+
includes="com/splunk/logging/*.class,com/splunk/logging/log4j2/**" />
162+
163+
</jar>
164+
165+
<delete dir="${temp_build}/${classes}" />
166+
167+
<tar destfile="${release}/${id}-log4j2-${version}${suffix}"
168+
compression="${compressionType}">
169+
<zipfileset dir="${temp_build}" prefix="${id}" />
170+
</tar>
171+
172+
<delete dir="${temp_build}" />
173+
174+
</target>
129175

130176
<target name="build_logback" depends="compile"
131177
description="generate a logback only distribution">
@@ -134,7 +180,7 @@
134180

135181
<copy todir="${temp_build}/${lib}">
136182
<fileset dir="${lib}"
137-
includes="splunk_tlsv12.jar,logback*.jar,commons-lang-2.4.jar" />
183+
includes="splunk_tlsv12.jar,logback*.jar,commons*.jar,http*.jar" />
138184

139185
</copy>
140186

@@ -179,7 +225,7 @@
179225

180226

181227
<copy todir="${temp_build}/${lib}">
182-
<fileset dir="${lib}" includes="splunk_tlsv12.jar" />
228+
<fileset dir="${lib}" includes="splunk_tlsv12.jar,commons*.jar,http*.jar" />
183229

184230
</copy>
185231

‎config/jdklogging.properties

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
1-
#Example java.util.logging configuration using a Splunk REST Handler or Splunk Raw TCP Appender
1+
#Example java.util.logging configuration using a Splunk HEC Handler,Splunk REST Handler or Splunk Raw TCP Appender
22

33
#handlers = java.util.logging.ConsoleHandler
44
#handlers = com.splunk.logging.jdk.handler.SplunkRestHandler
5-
handlers = com.splunk.logging.jdk.handler.SplunkRawTCPHandler
5+
#handlers = com.splunk.logging.jdk.handler.SplunkRawTCPHandler
6+
handlers = com.splunk.logging.jdk.handler.SplunkHECHandler
67

78
# Set the default logging level for the root logger
89
.level = INFO

‎config/log4j.properties

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
#Example log4j configuration using a Splunk REST Appender or Splunk Raw TCP Appender
1+
#Example log4j configuration using a Splunk HEC Appender, Splunk REST Appender or Splunk Raw TCP Appender
22

33
# Root logger option
44
log4j.rootLogger=DEBUG,stdout
55

66
#Splunk logger
7-
log4j.logger.splunk.logger=INFO, splunkrest
7+
log4j.logger.splunk.logger=INFO, splunkhec
88
#log4j.logger.splunk.logger=INFO, splunkrawtcp
99
log4j.additivity.splunk.logger=false
1010

‎config/log4j2.xml

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,26 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22

3-
<!--Example log4j2 configuration using a Splunk Raw TCP and UDP Appender -->
3+
<!--Example log4j2 configuration using a Splunk HEC, Raw TCP and UDP Appender -->
44

55

6-
<Configuration status="info" name="MySplunkApp" packages="">
6+
<Configuration status="info" name="MySplunkApp" packages="com.splunk.logging.log4j2.appender">
77

88
<Appenders>
99

10+
<SplunkHECAppender name="splunkhec"
11+
token="YOUR TOKEN"
12+
host="somehost"
13+
port="8088"
14+
https="false"
15+
poolsize="1"
16+
index="main"
17+
source="foo"
18+
sourcetype="bar" >
19+
20+
<PatternLayout pattern="%m%n" />
21+
22+
</SplunkHECAppender>
23+
1024
<Socket name="splunkrawtcp" protocol="TCP" host="ubuntu-splunk"
1125
port="5151">
1226
<PatternLayout pattern="%m%n" />
@@ -35,7 +49,8 @@
3549
<AppenderRef ref="stdout" />
3650
</Root>
3751
<logger name="splunk.logger" additivity="false" level="INFO">
38-
<appender-ref ref="splunkrawtcp" />
52+
<appender-ref ref="splunkhec" />
53+
<!-- <appender-ref ref="splunkrawtcp" /> -->
3954
<!-- <appender-ref ref="splunkrawudp" /> -->
4055
<!-- <appender-ref ref="failover_example" /> -->
4156
</logger>

‎config/logback.xml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22

3-
<!--Example logback configuration using a Splunk REST Appender or Splunk Raw TCP Appender -->
3+
<!--Example logback configuration using a Splunk HEC Appender, Splunk REST Appender or Splunk Raw TCP Appender -->
44

55
<configuration>
66

@@ -41,7 +41,7 @@
4141
</appender>
4242

4343
<!--Send log events to a Splunk HEC Endpoint-->
44-
<appender name="splunkrawtcp" class="com.splunk.logging.logback.appender.SplunkHECAppender">
44+
<appender name="splunkhec" class="com.splunk.logging.logback.appender.SplunkHECAppender">
4545
<port>8088</port>
4646
<host>somehost</host>
4747
<token>YOUR TOKEN</token>
@@ -71,8 +71,7 @@
7171

7272
<!--Splunk logger-->
7373
<logger name="splunk.logger" additivity="false" level="INFO">
74-
<appender-ref ref="splunkrest"/>
75-
<appender-ref ref="splunkrawtcp"/>
74+
<appender-ref ref="splunkhec"/>
7675
</logger>
7776

7877
<!--Root logger-->

‎lib/log4j-api-2.0-beta9.jar

-106 KB
Binary file not shown.

‎lib/log4j-api-2.3.jar

133 KB
Binary file not shown.

‎lib/log4j-core-2.0-beta9.jar

-665 KB
Binary file not shown.

‎lib/log4j-core-2.3.jar

808 KB
Binary file not shown.

0 commit comments

Comments
 (0)